Re: [PATCH v2] perf annotate: Use jump__delete when freeing LoongArch jumps

[sashiko-bot@kernel.org]

Sashiko AI review found 1 potential issue(s):
- [High] In `loongarch_call__parse`, missing verification of `strchr` return value causes a NULL pointer dereference if the objdump string does not contain '<'.
--

commit aaedf6d99ebecdf735574de2bae5e0ee0fc41c3f
Author: Rong Bao <rong.bao@csmantle.top>

perf annotate: Use jump__delete when freeing LoongArch jumps

This patch initializes the .free field in loongarch_jump_ops to jump__delete.
This prevents disasm_line__free() from falling back to the default cleanup
function for LoongArch jump instructions, which previously led to undefined
behavior and a crash.

> diff --git a/tools/perf/util/annotate-arch/annotate-loongarch.c b/tools/perf/util/annotate-arch/annotate-loongarch.c
> index 950f34e59e5cd..c2addca77320b 100644
> --- a/tools/perf/util/annotate-arch/annotate-loongarch.c
> +++ b/tools/perf/util/annotate-arch/annotate-loongarch.c
> @@ -110,6 +110,7 @@ static int loongarch_jump__parse(const struct arch *arch, struct ins_operands *o
>  }
>  
>  static const struct ins_ops loongarch_jump_ops = {
> +	.free	   = jump__delete,
>  	.parse	   = loongarch_jump__parse,
>  	.scnprintf = jump__scnprintf,
>  	.is_jump   = true,

This isn't a regression introduced by this patch, but in this same file,
could loongarch_call__parse() cause a NULL pointer dereference?

If the objdump output represents a call without a symbol and lacks
'<...>', strchr() returns NULL, but name is immediately incremented:

tools/perf/util/annotate-arch/annotate-loongarch.c:loongarch_call__parse() {
	...
	ops->target.addr = strtoull(c, &endptr, 16);

	name = strchr(endptr, '<');
	name++;

	if (arch->objdump.skip_functions_char &&
	    strchr(name, arch->objdump.skip_functions_char))
		return -1;
	...
}

Would this result in an invalid pointer and cause a crash when passed to
the subsequent strchr() calls?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260413100412.2313688-1-rong.bao@csmantle.top?part=1